Regulation (EU) 2016/679

Regulation (EU) 2016/679
User:Verdy p, User:-xfi-, User:Paddu, User:Nightstallion, User:Funakoshi, User:J · Public domain · source
Title	Regulation (EU) 2016/679
Type	Regulation
Adopted	2016-04-27
Effective	2018-05-25
Jurisdiction	European Union
Subject	Data protection
Status	In force

Regulation (EU) 2016/679 is a major European Union legal instrument that harmonised data protection rules across the European Union, replacing previous directives and shaping international practices in privacy law. Its adoption followed intensive negotiation among European Parliament, Council of the European Union, and European Commission, and it has influenced jurisprudence at the Court of Justice of the European Union and policy at national parliaments such as the Bundestag, Assemblée nationale, and Cortes Generales.

Background and legislative history

The regulation emerged from a reform process initiated by the European Commission under President Jean-Claude Juncker with legislative involvement from the European Parliament led by Presidents such as Martin Schulz and Antonio Tajani and from the Council of the European Union chaired by rotating presidencies like Netherlands and Slovenia. Drafting drew on earlier instruments including the Data Protection Directive 95/46/EC, and debates referenced influential reports by bodies like the European Data Protection Supervisor and the Article 29 Working Party. Key milestones included trilogue negotiations involving figures from the European People's Party, Progressive Alliance of Socialists and Democrats, and Alliance of Liberals and Democrats for Europe Party, culminating in the 2016 vote by the European Parliament and signature processes involving the President of the European Parliament and the President of the European Council.

Scope and key definitions

The regulation sets out territorial scope affecting entities in United Kingdom (pre-Brexit arrangements), France, Germany, Italy, Spain, and other member states, and applies extraterritorially to controllers and processors in locations such as United States, China, India, and Brazil when offering goods or services to data subjects in the EU. Core definitions include "personal data", "processing", "controller", "processor", and "consent", terms that echo prior case law from the Court of Justice of the European Union and guidance from the European Data Protection Board and the Council of Europe. The regulation distinguishes special categories of data related to health as discussed by institutions like the World Health Organization and biometric modalities referenced in studies from Max Planck Institute and Oxford University.

Principles and lawful bases for processing

Fundamental principles such as lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality echo jurisprudence from the European Court of Human Rights and policy recommendations from Organisation for Economic Co-operation and Development. Lawful bases for processing include consent, performance of a contract, compliance with legal obligations of states like Germany or Poland, protection of vital interests in contexts involving the Red Cross or European Medicines Agency, public tasks as performed by bodies such as the European Central Bank, and legitimate interests analyzed against precedents involving entities like Facebook, Google, Amazon, and Microsoft.

Rights of data subjects

The regulation grants rights including the right to access, right to rectification, right to erasure (often discussed in litigation involving Google and the Court of Justice of the European Union), right to restriction of processing, right to data portability invoked by firms such as Apple and Samsung, right to object, and rights in relation to automated decision-making and profiling debated in hearings at the European Parliament and panels with representatives from Amnesty International and European Consumer Organisation (BEUC). Enforcement of these rights has involved national courts like the Bundesverfassungsgericht and agencies such as the Information Commissioner's Office in the United Kingdom and the Commission nationale de l'informatique et des libertés in France.

Obligations of controllers and processors

Controllers and processors must implement appropriate technical and organisational measures, maintain records of processing activities, and carry out data protection impact assessments in contexts like operations of Airbus, Siemens, Deutsche Telekom, and Vodafone. Obligations include appointing data protection officers in organisations such as Universität Leipzig or multinational firms like IBM and reporting personal data breaches to supervisory authorities and affected individuals, following protocols similar to those in standards from International Organization for Standardization and case studies from European Banking Authority.

Supervisory authorities and enforcement

Supervisory authorities operate at national level, for example the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit in Germany, the Garante per la protezione dei dati personali in Italy, and the Agencia Española de Protección de Datos in Spain, coordinated at EU level by the European Data Protection Board. Enforcement mechanisms include administrative fines, seen in cases involving Google LLC, British Airways, Marriott International, and WhatsApp, and judicial remedies pursued before national courts and the Court of Justice of the European Union. Cooperation tools include the one-stop-shop mechanism affecting cross-border cases involving multinationals like Uber Technologies and Airbnb.

Impact and criticism

The regulation has prompted reforms across sectors including technology firms like Facebook, Google, Twitter, and LinkedIn and financial institutions such as Deutsche Bank and Banco Santander, influenced transatlantic data transfer mechanisms debated between the European Commission and the United States Department of Commerce and litigated in cases involving Schrems II and organizations like Max Schrems and NOYB. Criticisms have come from stakeholders including European Small and Mid-sized Businesses, Chamber of Commerce of the European Union, and privacy advocates like La Quadrature du Net regarding compliance costs, from academics at London School of Economics and Harvard University about innovation impacts, and from national authorities about uneven enforcement across member states such as Poland and Hungary.

Category:European Union law